Skip to content
This repository has been archived by the owner on Jun 27, 2022. It is now read-only.

Fix OauthPlugin query aggregation always being default #15

Merged
merged 1 commit into from
Mar 19, 2014
Merged

Fix OauthPlugin query aggregation always being default #15

merged 1 commit into from
Mar 19, 2014

Conversation

bradfeehan
Copy link
Contributor

This is the same as guzzle/guzzle#596, but submitted to the correct repository for Guzzle 3. Here's what I wrote there describing the issue:

When using OauthPlugin for a request with a non-default query aggregator set (e.g. CommaAggregator), it creates invalid OAuth signatures. This is because it uses the default query aggregator to construct the "string to sign". The string to sign then contains the query string parameters in a different format to the actual query string of the request:

Request URI: http://example.com/test?a=b,c,d
OAuth string to sign (un-escaped): GET&http://example.com/test&a[0]=b&a[1]=c&a[2]=d...

I took @mtdowling's advice, and this time avoided a QueryString::getAggregator() method. Instead I clone the entire QueryString from the request, then replace its data with the parameters to be signed.

It's a bit dirty as it unnecessarily subjects the oauth_* parameters to the query aggregation strategy of the request's QueryString. However, there should be no effects of this -- because these never have arrays as their value, they will never be subjected to aggregation anyway. If this approach is also undesirable, I'll probably need to hand the implementation over to a maintainer as I don't think I'll have the time to do a more significant refactoring.

->set('g', array('h', 'i', 'j'))
->set('k', array('l'))
->set('m', array('n', 'o'));
// print_r($request->getQuery()); die;
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you remove this line please?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Eep, sorry for missing this. Fixed in 562546b.

@mtdowling
Copy link
Member

Nice work. I don't find this dirty at all. I'll merge after the debug line is removed the tests.

The Oauth "string to sign" includes the query string parameters,
together with the OAuth parameters. Guzzle uses a QueryString instance
to combine the two. However, it was incorrectly using the default
aggregator, instead of the actual aggregator used by the QueryString
that's part of the request.

This change uses the QueryString from the request to serialise the
parameters to be signed. This will affect the aggregation of the Oauth
parameters as well -- however aggregation should never occur for these
because there is only one value for each key.
@bradfeehan
Copy link
Contributor Author

Thanks @mtdowling. Fixed the issue as requested and tests are passing. :shipit:

@mtdowling
Copy link
Member

Thanks!

mtdowling added a commit that referenced this pull request Mar 19, 2014
Fix OauthPlugin query aggregation always being default
@mtdowling mtdowling merged commit 2be45ef into guzzle:master Mar 19, 2014
@bradfeehan
Copy link
Contributor Author

Will this make it into a tagged release? I'm currently having to depend on dev-master to include this change and would prefer to rely on (e.g.) 3.8.2.

@mtdowling
Copy link
Member

Yeah, but I'm not sure when the next release will happen. Soon I hope.

@bradfeehan
Copy link
Contributor Author

Thanks. I was just checking that the delay wasn't accidental.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
2 participants